How do I track changes to the policy?

[roadrunner]

How do I track changes to the policy?
In NG and later, go to the Log Viewer, select the "Audit" log mode. In NG FP2 and above, you can also keep policy revisions by enabling Revision Control. This will allow you to track changes to policies that were loaded on the firewall and revert back to these versions if necessary.

One thing I've always preached is a good naming scheme for policies. On a production system, I typically use the following format:

firewall_name-username-yyyymmdd-nn

Where:


firewall_name is the name of the firewall used
username is the user who made the policy
yyyymmdd is the date this policy was made (yyyy = 4-digit year, mm = 2-digit month, dd = 2-digit day)
nn is the 2-digit number of the policy for that day
So for example if this was the third policy of day on mrhat and I made the last change, then the policy would be called:

mrhat-dwelch-19991227-03

Also, you can use $FWDIR/log/cpmgmt.aud (4.1), $FWDIR/log/fwui.log (4.0 and earlier) to track when an administrator logged on and when they loaded a policy. Below is a sample of this file:

Mon Dec 27 11:20:18 1999 rule-editor @kenny: @kenny Logged in >>>>
Mon Dec 27 11:20:18 1999 rule-editor dwelch@kenny: Locking DB with '01010101' permissions
Mon Dec 27 11:21:39 1999 rule-editor dwelch@kenny: Setting properties
Mon Dec 27 11:21:42 1999 rule-editor dwelch@kenny: Setting properties
Mon Dec 27 11:21:42 1999 rule-editor dwelch@kenny: Storing objects
Mon Dec 27 11:21:43 1999 rule-editor dwelch@kenny: Storing rulebase(s)
Mon Dec 27 11:21:43 1999 rule-editor dwelch@kenny: Storing rulebase 'Standard.W'
Mon Dec 27 11:21:43 1999 rule-editor dwelch@kenny: Storing rulebase 'av.W'
Mon Dec 27 11:21:43 1999 rule-editor dwelch@kenny: Storing rulebase 'allowall.W'
Mon Dec 27 11:21:43 1999 rule-editor dwelch@kenny: Storing rulebase 'vpntest.W'
Mon Dec 27 11:21:43 1999 rule-editor dwelch@kenny: Storing rulebase 'template.W'
Mon Dec 27 11:21:44 1999 rule-editor dwelch@kenny: Setting properties
Mon Dec 27 11:21:45 1999 rule-editor dwelch@kenny: Setting properties
Mon Dec 27 11:21:45 1999 rule-editor dwelch@kenny: Installing rulebase '/opt/pkg/FireWall-1-strong.v4.0.SP-4/conf/av.W' on host 'mrhat'
Mon Dec 27 11:21:45 1999 rule-editor dwelch@kenny: Installing rulebase '/opt/pkg/FireWall-1-strong.v4.0.SP-4/conf/av.W' on host 'mrtwig'
Mon Dec 27 11:21:56 1999 ------------------------------: dwelch@kenny Logged out
-- PhoneBoy - 14 Jan 2004


FAQForm
FAQs.Class: SmartClientsFAQs
FAQs.OS:
FAQs.Version: